Granted Patent B2

US 12,500,894 · App. 18/464,382 · Granted Dec 16, 2025

Inventors: John Burns Smith, III (Charlotte, NC); Nicholas Shawn Twerdochlib (Callahan, FL)

Assignee: BeyondTrust Corporation

H04L63/102H04L63/08H04L63/0428

Abstract

Claims (44)

1 . A system, comprising:

a privilege access management (PAM) appliance comprising at least one first computing device, wherein the at least one first computing device is configured to:

receive an access request from an accessor device to access an endpoint device;

establish a session via a secure connection between the accessor device and the endpoint device;

transmit a request for credential information available for the accessor device to access the endpoint device from a credential management device; and

the credential management device comprises at least one second computing device, wherein the at least one second computing device is configured to:

receive the request for credential information available for the accessor device to access the endpoint device;

extract a set of credentials that are available for the accessor device from a plurality of credentials; and

provide at least one of the set of credentials to the endpoint device for the accessor device for the session.

2 . The system of claim 1 , wherein the at least one second computing device is further configured to transmit identifying information for the set of credentials excluding full credentials to the PAM appliance.

3 . The system of claim 2 , wherein the at least one second computing device is further configured to provide at least one of the set of credentials to the endpoint device by securely transmitting the full credentials to the endpoint device.

4 . The system of claim 3 , wherein the at least one second computing device is further configured to securely transmit the full credentials through the PAM appliance.

5 . The system of claim 1 , wherein the at least one of the set of credentials is selected by the accessor device, via the PAM appliance, from the set of credentials.

6 . The system of claim 1 , wherein the request to transmit credential information is sent subsequent to the session being established by the PAM appliance.

7 . The system of claim 1 , wherein the at least one first computing device is further configured to:

receive a second selection of a second credential from the set of credentials via a user interface mechanism; and

run an application on the endpoint device as a different user corresponding to the second credential.

8 . A method, comprising:

receiving, via a privilege access management (PAM) appliance, an access request from an accessor device to access an endpoint device;

establishing, via the PAM appliance, a session via a secure connection between the accessor device and the endpoint device;

transmitting, via the PAM appliance, a request for credential information available for the accessor device to access the endpoint device from a credential management device;

extracting, via the credential management device, a set of credentials that are available for the accessor device from a plurality of credentials; and

providing, via the credential management device, at least one of the set of credentials to the endpoint device for the accessor device for the session.

9 . The method of claim 8 , further comprising applying, via the credential management device, a policy to the plurality of credentials to determine the set of credentials.

10 . The method of claim 8 , further comprising providing, via the credential management device, at least one name for the at least one of the set of credentials to the PAM appliance excluding a full credential.

11 . The method of claim 8 , further comprising:

restricting the set of credentials based on a location of the accessor device; and

receiving, via the PAM appliance, a selection of one of the restricted set of credentials from the accessor device, wherein the at least one of the set of credentials comprises the one of the restricted set of credentials selected.

12 . The method of claim 8 , further comprising:

rendering, via the PAM appliance, a user interface comprising the set of credentials for the accessor device; and

receiving, via the PAM appliance, a selection of one of the set of credentials from the accessor device.

13 . The method of claim 12 , wherein the user interface excludes full credential information.

14 . A non-transitory computer-readable medium embodying a program that, when executed by at least one computing device, causes the at least one computing device to:

receive an access request from an accessor device to access an endpoint device;

establish a session via a secure connection between the accessor device and the endpoint device;

transmit a request for credential information available for the accessor device to access the endpoint device from a credential management device;

receive information for at least one of a set of credentials available for the accessor device extracted from a plurality of credentials stored on the credential management device; and

provide the at least one of the set of credentials to the endpoint device for the accessor device for the session.

15 . The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to determine that the set of credentials is available from the plurality of credentials for the accessor device, a user of the accessor device, or a combination thereof.

16 . The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to transmit the credential information to an endpoint client of the endpoint device to log the accessor device into the endpoint device for the session.

17 . The non-transitory computer-readable medium of claim 16 , wherein the program further causes the at least one computing device to provide the endpoint client as a downloadable application to the endpoint.

18 . The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to receive the access request from the accessor device via a web interface on a public IP address.

19 . The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to determine that the accessor device has credentials to access resources of the endpoint device, wherein the request for credential information available for the accessor device is transmitted in response to determining that the accessor device has credentials.

20 . The non-transitory computer-readable medium of claim 14 , wherein the session is established through the at least one computing device.

Assignments (2)

Continuity (4)

References Cited (207)